AI Sec Watch

TypeBot is a chatbot builder tool that had a vulnerability in versions before 3.16.0 where the OpenAI transcription feature didn't properly validate audio URLs, allowing attackers to perform SSRF (server-side request forgery, where a server is tricked into making requests to internal or restricted addresses) and access internal systems. An attacker could exploit this to make the server fetch content from arbitrary internal addresses and send it to OpenAI's Whisper API for transcription.

Bash-it version 3.2.0 has a vulnerability where a malicious pyproject.toml file can inject terminal escape sequences (special codes that control terminal behavior) into the command prompt. When a user enters a directory with this malicious file, the unfiltered content gets added to the prompt without removing these control characters, causing the terminal to execute unwanted commands every time the prompt appears.

PapersGPT for Zotero 0.6.1 has a remote code execution vulnerability (RCE, where attackers can run commands on a system they don't own) that lets attackers execute malicious JavaScript code by tricking the AI into returning harmful instructions through prompt injection (hiding malicious commands in AI inputs), intercepting network traffic, or using a fake AI endpoint. This gives attackers dangerous abilities like reading and writing files, running programs, and stealing all data in Zotero (a research management tool).

Both ChatGPT and Google's Gemini (AI chatbots that generate human-like responses to user questions) have each reached 1 billion monthly users, making them among the fastest-growing applications ever. ChatGPT hit this milestone first, though OpenAI announced it quietly in a blog post rather than through a major announcement.

Claude Code Templates is a CLI tool with a critical vulnerability in versions before 1.29.4 where its Studio server binds to all network interfaces without authentication and allows attackers to execute arbitrary operating-system commands (running code on a system without permission) by sending specially crafted requests to the /api/execute or /api/install-agent endpoints. An attacker can exploit this by directly accessing the server or tricking a developer into visiting a malicious website, potentially stealing source code, credentials, and local data.

DSPy 3.3.0b1 has a vulnerability where attackers can trick the AI into reading files from a computer and sending them to an attacker-controlled server. The vulnerability exists in the Image and Audio output adapters, which process untrusted outputs from language models (the AI's responses) without proper safety checks, allowing an attacker to inject a file path that the system then reads and encodes into messages.

Cursor is a code editor designed for AI-assisted programming. In versions before 3.0.0 on macOS, a security flaw allowed an agent running in Auto-Run Sandbox mode to launch a privileged container (a lightweight virtual environment) that could access the user's home directory and run commands on the computer without asking for permission first.

Cursor is a code editor designed for programming with AI assistance. Before version 3.1.2, Cursor IDE on macOS had a security flaw where an AI agent running in Auto-Run Sandbox mode (a restricted environment meant to limit what code can do) could trick the system into running malicious Python code outside the sandbox with full user privileges, potentially allowing an attacker to modify files and launch programs. This vulnerability is fixed in version 3.1.2.

Bitcoin miner Riot Platform has agreed to lease 191 megawatts of computing power to Anthropic (an AI company) for $9 billion over 20 years, marking a shift from bitcoin mining to providing infrastructure for AI systems. As cryptocurrency prices remain low and AI demand surges, bitcoin mining companies are increasingly pivoting to become AI infrastructure providers, since AI companies need the same scarce power and computing resources that miners already own.